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Abstract. We study some extensions of Grover's quantum searching 
algorithm. First, we generalize the Grover iteration in the light of 
a concept called amplitude amplification. Then, we show that the 
quadratic speedup obtained by the quantum searching algorithm over 
classical brute force can still be obtained for a large family of search 
problems for which good classical heuristics exist. Finally, as our main 
result, we combine ideas from Grover's and Shor's quantum algorithms 
to perform approximate counting, which can be seen as an amplitude 
estimation process. 



1 Introduction 

Quantum computing is a field at the junction of theoretical modern physics and 
theoretical computer science. Practical experiments involving a few quantum 
bits have been successfully performed, and much progress has been achieved 
in quantum information theory, quantum error correction and fault tolerant 
quantum computation. Although we are still far from having desktop quantum 
computers in our offices, the quantum computational paradigm could soon be 
more than mere theoretical exercise and references therein]. 

The discovery by Peter Shor | p2[ of a polynomial-time quantum algorithm for 
factoring and computing discrete logarithms was a major milestone in the his- 
tory of quantum computing. Another significant result is Lov Grover's quantum 
search algorithm ||T^. Grover's algorithm does not solve NP-complete problems 
in polynomial time, but the wide range of its applications compensates for this. 

The search problem and Grover's iteration are reviewed in Section ^. It was 
already implicit in |Q that the heart of Grover's algorithm can be viewed as an 
amplitude amplification process. Here, we develop this viewpoint and obtain a 
more general algorithm. 

When the structure in a search problem cannot be exploited, any quantum 
algorithm requires a computation time at least proportional to the square root of 
the time taken by brute- force classical searching B. In practice, the structure of 
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the search problem can usuaUy be exploited, yielding deterministic or heuristic 
algorithms that are much more efficient than brute force would be. In Section ^ 
we study a vast family of heuristics for which we show how to adapt the quantum 
search algorithm to preserve quadratic speedup over classical techniques. 

In Section ^, we present, as our main result, a quantum algorithm to perform 
counting. This is the problem of counting the number of elements that fulfill some 
specific requirements, instead of merely finding such an element. Our algorithm 
builds on both Grover's iteration |jl^ as described in Q| and the quantum Fourier 
transform as used in . The accuracy of the algorithm depends on the amount 
of time one is willing to invest. As Grover's algorithm is a special case of the 
amplitude amplification process, our counting algorithm can also be viewed as 
a special case of the more general process of amplitude estimation. 

We assume in this paper that the reader is familiar with basic notions of 
quantum computing j!],!). 



2 Quantum Amplitude Amplification 

Consider the following search problem: Given a Boolean function F : X {0, 1} 
defined on some finite domain X, find an input x £ X for which F{x) — 1, 
provided such an x exists. We assume that F is given as a black box, so that it is 
not possible to obtain knowledge about F by any other means than evaluating it 
on points in its domain. The best classical strategy is to evaluate F on random 
elements of X. If there is a unique Xq & X on which F takes value 1, this strategy 
evaluates F on roughly half the elements of the domain in order to determine xq. 
By contrast, Grover ]lO| discovered a quantum algorithm that only requires an 
expected number of evaluations of F in the order of ^fN , where A'' = |X| denotes 
the cardinality of X. 

It is useful for what follows to think of the above-mentioned classical strategy 
in terms of an algorithm that keeps boosting the probability of finding xq. The 
algorithm evaluates F on new inputs, until it eventually finds the unique input Xq 
on which F takes value 1. The probability that the algorithm stops after exactly 
j evaluations of F is 1/iV (1 < j < iV — 2), and thus we can consider that each 
evaluation boosts the probability of success by an additive amount of 1/iV. 

Intuitively, the quantum analog of boosting the probability of success would 
be to boost the amplitude of being in a certain subspace of a Hilbert space, and 
indeed the algorithm found by Grover can be seen as working by that latter 
principle . As discovered by Brassard and Il0yer , the idea of amplifying 
the amplitude of a subspace is a technique that applies in general. Following 
we refer to this as amplitude amplification, and describe the technique below. 
For this, we require the following notion, which we shall use throughout the rest 
of this section. 

Let |r) be any pure state of a joint quantum system Ti.. Write |T) as a 
superposition of orthonormal states according to the state of the first subsystem: 



\r) = Y,x,\im) 



so that only a finite number of the states have nonzero amphtude Xi. 

Every Boolean function x : Z ^ {0, 1} induces two orthogonal subspaces 
of H, allowing us to rewrite \T) as follows: 

\T) = \T^) + \T')= J2 ^^\m)+ E w 

We say that a state is good if x(*) — 1, and otherwise it is bad. Thus, we 
have that |T°) denotes the projection of |T) onto the subspace spanned by the 
good states, and similarly |T^) is the projection of |T) onto the subspace spanned 
by the bad states. Let ar — (T^jT") denote the probability that measuring |T) 
produces a good state, and similarly let br = {T^\T''). Since |T") and |T^) are 
orthogonal, we have ar + bx = 1- 

Let A be any quantum algorithm that acts on Ti. and uses no measurements. 
The heart of amplitude amplification is the following operator 

Q = Q(Ax>,'^) = -^S^-A-iS5^. (2) 

Here, (j) and ip are complex numbers of unit norm, and operator S!^ conditionally 
changes the phase by a factor of (p: 

ifx(*) = i 
ifx(*) = o. 

Further, Sg changes the phase of a state by a factor of (j) if and only if the first 
register holds a zero. The operator Q is a generalization of the iteration applied 
by Grover in his original quantum searching paper |To[ . It was first used in Q to 
obtain an exact quantum polynomial-time algorithm for Simon's problem. It is 
well-defined since we assume that A uses no measurements and, therefore, A has 
an inverse. 

Denote the complex conjugate of A by A*. It is easy to show the following 
lemma by a few simple rewritings. 

Lemma 1. Let \T) be any superposition. Then 

AStA-^\r) = \r) -{1-^){T\A\0)*A\0). 

By factorizing Q as {ASqA^^){—S'-^), the next lemma follows. 

Lemma 2. Let \T) — jT") + \T^) be any superposition. Then 

Q \r-) = -^\T-) + p{l - 0) (T«|^|0)*^|0) (3) 
Q|T^)= -\r'')+ {1-^){T''\A\0)*A\0). (4) 




In particular, letting |T) be A\0) = + implies that the subspace 
spanned by and is invariant under the action of Q. 



Lemma 3. Let A\0) = \>F) = \>P'') + l^F^). Then 



Q\1r'') = (p{{l-<t>)a-l)\'F'')+ - 4>)a\'F'>) (5) 

Q l*'^) = -((1 - 0)a + 0)1^''') + (1 - </>)(! - a)\^-), (6) 

where a = (if'°|tf'°). 

From Lemmas || and ||it follows that, for any vector |T) = |T") + IT*"), the 
subspace spanned by the set {I?""), \T^), is invariant under the action 

of Q. By setting (jj = ip = —1, we find the following much simpler expressions. 

Lemma 4. Let A\0) = \>F) = \>F'') + , and let Q Q{A,x,-l, -I) ■ Then 

Q|!f") = (l-2a)|!f''^) -2a|!f'') (7) 
Ql'f'') = (l-2a)|*''')+26|!f''^), (8) 

where a = {^°'\^'') and b = 1 - a = {<F^\'F^). 

The recursive formulae defined by Equations and ^ were solved in 
and their solution is given in the following theorem. The general cases defined 
by Equations have similar solutions, but we shall not need them in what 
follows. 

Theorem 1 (Amplitude Amplification — simple case). Let A\0) = = 
[if") + ll'''), and let Q = Q(Ax,-l,-l)- Then, for all j > 0, 

QM|0) =%|tf''')+^,|<f''), 

where 

kj = sin((2j + 1)61) and = , ^ cos((2j + 1)6*), 
ya V 1 — a 

and where 9 is defined so that sin^ 6 = a = and < 9 < n/2. 

Theorem |] yields a method for boosting the success probability a of a quan- 
tum algorithm A. Consider what happens if we apply A on the initial state 
|0) and then measure the system. The probability that the outcome is a good 
state is a. If, instead of applying A, we apply operator Q"^A for some inte- 
ger TO > 1, then our success probability is given by afc^ = sin^((2TO -I- 1)9). 
Therefore, to obtain a high probability of success, we want to choose integer m 
such that sin^((2TO -t- 1)9) is close to 1. Unfortunately, our ability to choose to 
wisely depends on our knowledge about 9, which itself depends on a. The two 
extreme cases are when we know the exact value of a, and when we have no 
prior knowledge about a whatsoever. 

Suppose the value of a is known. If a > 0, then by letting to = [7r/40J , we 
have that ak^ > 1 — a, as shown in B. The next theorem is immediate. 



Theorem 2 (Quadratic speedup). Let A be any quantum algorithm that uses 
no measurements, and let x '■ ^ {0, 1} he any Boolean function. Let the initial 
success probability a and angle 6 be defined as in Theorem ^. Suppose a > 
and set m — \tt /A9\ . Then, if we compute Q™y^|0) and measure the system, the 
outcome is good with probability at least max(l — a, a). 

This theorem is often referred to as a quadratic speedup, or the square-root 
running-time result. The reason for this is that if an algorithm A has success 
probability a > 0, then after an expected number of 1/a applications of A, 
we will find a good solution. Applying the above theorem reduces this to an 
expected number of at most (2m + — a) G 0{^\/a ) applications of A and 
its inverse. 

Suppose the value of a is known and that < a < 1. Theorem ^ allows us to 
find a good solution with probability at least max(l — a,a). A natural question 
to ask is whether it is possible to improve this to certainty, still given the value 
of a. ft turns out that the answer is positive. This is unlike classical computers, 
where no such general de-randomization technique is known. We now describe 
two optimal methods for obtaining this, but other approaches are possible. 

The first method is by applying amplitude amplification, not on the origi- 
nal algorithm A, but on a slightly modified version of it. If m = -k/AO — 1/2 is 
an integer, then we would have — 0, and we would succeed with certainty. 
In general, mo — [m] iterations is a fraction of 1 iteration too many, but we 
can compensate for that by choosing — 7r/(4mo -1-2), an angle slightly smaller 
than 9. Any quantum algorithm that succeeds with probability ao such that 
sin^ ^0 — da, will succeed with certainty after mg iterations of amplitude ampli- 
fication. Given A and its initial success probability a, it is easy to construct a 
new quantum algorithm that succeeds with probability ag < a: Let B denote the 
quantum algorithm that takes a single qubit in the initial state |0) and rotates it 
to the superposition — aa/a |0) -I- y^ao/a |1). Apply both A and B, and define 
a good solution as one in which A produces a good solution, and the outcome 
of B is the state |1). 

The second method is to slow down the speed of the very last iteration. First, 
apply mo = [mj iterations of amplitude amplification with = </? = — 1. Then, 
if mo < m, apply one more iteration with complex phase-shifts (f) and tp satisfying 
= 2a(l — Re((/))) and so that 1^9(1 — (fyak^^ — ((1 — 0)a -I- (fy^mo vanishes. 
Going through the algebra and applying Lemma ^ shows that this produces 
a good solution with certainty. For the case mo = 0, this second method was 
independently discovered by Chi and Kim Q . 

Suppose now that the value of a is not known. In Section ^, we discuss 
techniques for finding a good estimate of a, after which one then can apply a 
weakened version of Theorem ^ to find a good solution. Another idea is to try 
to find a good solution without prior computation of an estimate of a. Within 
that approach, by adapting the ideas in Section 4 in |^ (Section 6 in its final 
version), we can still obtain a quadratic speedup. 

Theorem 3 (Quadratic speedup without knowing a). Let A be any quan- 
tum algorithm that uses no measurements, and tet x : Z ^ {0, 1} be any Boolean 



function. Let the initial success probability a of A be defined as in Theorem [J. 
Then there exists a quantum algorithm that finds a good solution using an ex- 
pected number of 0{yj\/a ) applications of A and its inverse if a > 0, and 
otherwise runs forever. 

By applying this theorem to the searching problem defined in the first para- 
graph of this section, we obtain the following result from Q, which itself is a 
generalization of the work by Grover . 

Corollary 1. Let F : X ^ {0, 1} be any Boolean function defined on a finite 
set X . Then there exists a quantum algorithm Search that finds an x € X such 
that F{x) — 1 using an expected number of 0{\/\X\/t ) evaluations of F, pro- 
vided such an x exists, and otherwise runs forever. Here t = \{x G X \ F{x) = 1}| 
denotes the cardinality of the preimage of 1. 

Proof. Apply Theorem ^ with x = F A being any unitary transformation 
that maps |0) to X^xex such as the Walsh-Hadamard transform. □ 



3 Quantum Heuristics 

If function F has no useful structure, then quantum algorithm Search will 
be more efficient than any classical (deterministic or probabilistic) algorithm. 
In sharp contrast, if some useful information is known about the function, then 
some classical algorithm might be very efficient. Useful information might be 
clear mathematical statements or intuitive information stated as a probability 
distribution of the likelihood of x being a solution. The information we have 
about F might also be expressed as an efficient classical heuristic to find a 
solution. In this section, we address the problem of heuristics. 

Search problems, and in particular NP problems, are often very difficult to 
solve. For many NP-complete problems, practical algorithms are known that 
are more efficient than brute force search on the average: they take advantage 
of the problem's structure and especially of the input distribution. Although in 
general very few theoretical results exist about the efficiency of heuristics, they 
are very efficient in practice. 

We concentrate on a large but simple family of heuristics that can be ap- 
plied to search problems. Here, by heuristics, we mean a probabilistic algorithm 
running in polynomial time that outputs what one is searching for with some 
nonzero probability. Our goal is to apply Grover's technique for heuristics in 
order to speed them up, in the same way that Grover speeds up black-box 
search, without making things too complicated. 

More formally, suppose we have a family J- of functions such that each F Cz J- 
is of the form F : X ^ {0, 1}. A heuristic is a function G : T x R X, for 
an appropriate finite set R. For every function F G !F, let tp ^ and 
hp = \{r E R \ F{G{F, r)) — 1}|. We say that the heuristic is efficient for a given 
F if hp/\R\ > tp/\X\ and the heuristic is good in general if 




Here Ejr denotes the expectation over all F according to some fixed distribution. 
Note that for some F, hp might be small but repeated uses of the heuristic, with 
seeds r uniformly chosen in R, will increase the probability of finding a solution. 

Theorem 4. Let F be a search problem chosen in a family T according to some 
probability distribution. If, using a heuristic G, a solution to F is found in 
expected time T then, using a quantum computer, a solution can be found in 
expected time in 0{y/T). 

Proof. We simply combine the quantum algorithm Search with the heuris- 
tic G. Let G'(r) = F{G{F,r)) and x = G(F, Search(G'))> so that F{x) = 1. 
By Corollary p], for each function F ^ we have an expected running 
time in 0{^/\R]/hp). Let Pp denote the probability that F occurs. Then 
^P(^jr Pp = Ij and we have that the expected running time is in the order 
of X^FeJ^ \/\R\/f^F Ppi which can be rewritten as 




by Cauchy-Schwarz's inequality. □ 



4 Approximate Counting 

In this section, we do not concentrate on finding one solution, but rather on 
counting them. For this, we complement Grover's iteration using techniques 
inspired by Shor's quantum factoring algorithm p^ . 

Counting Problem: Given a Boolean function F defined on some finite set 
X — {0, . . . , iV — 1}, find or approximate t ~ 

Before we proceed, here is the basic intuition. From Section || it follows that, 
in Grover's algorithm, the amplitude of the set as well as the amplitude 

of the set F~^(0), varies with the number of iterations according to a periodic 
function. We also note that the period (frequency) of this association is in direct 
relation with the sizes of these sets. Thus, estimating their common period using 
Fourier analysis will give us useful information on the sizes of those two sets. 
Since the period will be the same if F^^{1) has cardinality t or if F^^(l) has 
cardinality N — t, we will assume in the rest of this section that t < N/2. 

The quantum algorithm Count we give to solve this problem has two param- 
eters: the function F given as a black box and an integer P that will determine 
the precision of our estimate, as well as the time taken by the algorithm. For 
simplicity, we assume that P and N are powers of 2, but this is not essential. 
Our algorithm is based on the following two unitary transformations: 

Cp : |m) ® -> |m) (g) {GpY''\<F) 



Here t = V— T and = Q(W, F, —1, —1) denotes the iteration originally used 
by Grover where W denotes the Walsh-Hadamard transform on n qubits 

that maps |0) to 2-"/^J2Zo^ I*)- 

In order to apply Cp even if its first argument is in a quantum superposi- 
tion, it is necessary to have an upper bound on the value of to, which is the 
purpose of parameter P. Thus, unitary transformation C^? performs exactly P 
Grover's iterations so that P evaluations of F are required. The quantum Fourier 
transform can be efficiently implemented (see |^ for example). 

Count (F,P) 

1. Itf^o) ^ W® W |0)|0) 

2. ^ Cf\<Fo) 

3. Itf'2) ^ I'I'i) after the second register is measured (optional) 

4. ltf/3) ^ Fp®I\'F2) 

5. / ^ measure (if / > P/2 then f ^ {P ~ /)) 

6. output: NsiT?{f-K/P) (and / if needed) 

The following theorem tells us how to make proper use of algorithm Count. 

Theorem 5. Let F : {0, . . . , — 1} {0, 1} he a Boolean function, 

t = \F-'^{1)\ < N/2 and i be the output of Count(i^, P) with P>A, then 

27r 71-2 

\t-t\<—ViN^—N 
with probability at least S/tt^. 

Proof. Let us follow the state through the algorithm using notation from 
Section ||. 

l-^")- 7^ EE HI-) 



1 / 




We introduced Step || to make it intuitively clear to the reader why the Fourier 
transform in Step 4 gives us what we want. The result of this measurement is 
not used in the algorithm and this is why it is optional: the final outcome would 
be the same if Step ^ were not performed. Without loss of generality, assume 
that the state x observed in the second register is such that F{x) = 1. Then by 
replacing km by its definition we obtain 

p-i 

I'Z'a) sin((2TO+l)0)|TO), (9) 

771 — 



where a is a normalization factor that depends on 6. 



Let 



/ = pe/^. (10) 

In Step ^ we apply the Fourier transform on a sine (cosine) of period / and 
phase shift 9. From sin^ 9 = t/N we conclude that 9 < 7r/2 and / < P/2. After 
we apply the Fourier transform, the state jtf's) strongly depends on / (which 
depends on t). If / were an integer, there would be two possibilities: either / = 
(which happens if t = or t = TV), in which case jlfa) = |0), or f > 0, in which 
case jifa) = a\f) + b\P — /), where a and b are complex numbers of norm 1/ V2. 

In general / is not an integer and we will obtain something more complicated. 
We define = [/J and /+ = [/ + IJ . We still have three cases. If 1 < / < 
P/2 — 1, we obtain 

l-^s) = a\f-) + b\f+) + c\P - /-) + d\P - /+) + \R) 

where \R) is an un- normalized error term that may include some or all values 
other than the desirable f^,,f^,P — and P — f^. The two other possibilities 
are < / < 1, in which case we obtain 

\1'3)^a\0)+b\l)+c\P-l) + \R) 

or P/2 — 1 < / < P/2, in which case we obtain 

= a\P/2 - 1) + b\P/2) + c\P/2 + 1) + \R) . 

In all three cases, extensive algebraic manipulation shows that the square of the 
norm of the error term \R) can be upper bounded by 2/5, 

{R\R)<1. 

In order to bound the success probability by S/tt^ (which is roughly 0.81 and 
therefore larger than 1 — 2/5 = 0.6) as claimed in the statement of the Theorem, 
we could perform a complicated case analysis depending on whether the value x 
observed in Step || is such that F{x) = or F{x) = 1. Fortunately, in the light 
of some recent analysis of Michele Mosca [0, which itself is based on results 
presented in this analysis can be simplified. Since the information obtained 
by measuring the second register is not used, measuring it in a different basis 
would not change the behaviour of the algorithm. Measuring in the eigenvector 
basis of Gi?, one obtains this bound in an elegant way. Details will be provided 
in the final version of this paper. 

Assuming that / has been observed at Step 5 and applying Equation ^ and 
the fact that sin 9 ~ yJt/N , we obtain an estimate i oit such that 

27r , TT^ 

\t-t\ < —Vm+—N. 

□ 



Using a similar technique, it can be shown that the same quantum algorithm 
can also be used to perform amplitude estimation: Grover's algorithm [|lOj is to 
amplitude amplification what approximate counting is to amplitude estimation. 

Theorem 6. Replacing Gp inCp of algorithm Count by Q — Q{A, x, —1, — 1) 
and also modifying Step 6 so that the algorithm outputs a = sin^(/7r/P), 
Count (i*", P) with P > 4 will output a such that 

\a-a\ < —Va+ 

with probability at least S/tt^. 

In Theorems [s] and |6[ parameter P allows us to balance the desired accuracy 
of the estimate with the running time required to achieve it. We will now look 
at different choices for P and analyse the accuracy of the answer. To obtain t 
up to a few standard deviations, apply the following corollary of Theorem ^ 

Corollary 2. Given a Boolean function F : {0, . . . , A'^ — 1} — s- {0, 1} with t as 
defined above, Count{F, cV N ) outputs an estimate i such that 

\t-t\< —Vt+^ 

c c/ 

with probability at least and requires exactly c^/N evaluations of F. 

The above corollary states that some accuracy can be achieved with proba- 
bility S/tt^. This means that, as usual, the success probability can be boosted 
exponentially close to 1 by repetition. We will denote by Maj(fc, Count) an al- 
gorithm that performs k evaluations of Count and outputs the majority answer. 
To obtain an error probability smaller than 1/2", one should choose k in Q{n). 

If one is satisfied in counting up to a constant relative error, it would be 
natural to call Count with P = c^ N/t , but we need to use the following 
strategy because t is precisely what we are looking for. 

CountRel(P, c) 

1. P ^ 2 

2. Repeat 

(a) P ^ 2P 

(b) /VMaj(l2(loglog7V),Count(P,P)) 

3. Until / > 1 

4. Output Count(P, cP) 

Note that in the main loop the algorithm calls Count to obtain / and not i. 

Corollary 3. Given F with N and t as defined above, CountRel(P, c) outputs 
an estimate t such that 

\t - i\ < t/c 

with probability at least |, using an expected number of 0{{c + log log N) ^ N/t ) 
evaluations of F. 



Proof. Suppose for the moment that in Step 2(b) we always obtain / such that 
1/ — /I < 1. Combining this with Equation |l^ we see that to obtain / > 1, we 
must have P9/tt > 1. Since sin^ 9 = t/N, then P > 2y/N/t, so, by Theorem ||, 
|t — <| < t^{l + Thus, the core of the main loop will be performed at most 
log(2-\/ N/t ) times before P is large enough. By using i7(loglogAf) repetitive 
calls to Count in Step 2(b), we know that this will happen with suflrciently 
high probability, ensuring an overall success probability of at least 3/4. 

The expected number of evaluations of F follows from the fact that 

Etf '^\loglog^)2' G 0((loglogiV)y]v7t). □ 

Of course, to obtain a smaller relative error, the first estimate can be used 
in order to call Count with P as large as one wishes. From Theorem ||, it is 
clear that by letting P be large enough, one can make the absolute error smaller 
than 1. 

Corollary 4. Given F with N and t as defined above, there is an algorithm 
requiring an expected number of 0{\/tN ) evaluations of F that outputs an esti- 
mate i such that t — t with probability at least | using only space linear in logiV. 

Proof. By Theorem |, if P > 7r(2 + %/6)\/t]V, the error in the output of Count 
is likely to be smaller than 1/2. Again we do not know t, but we already know 
how to estimate it. By calling first Count(F, vW ) a few times, we obtain an 
approximation t such that |t — ?| < l-K^ft + vr^ with good probability. Now, 
assuming the first estimate was good, calling Count(F, 2Q\/tN ) we obtain t' = t 
with a probability of at least . Thus, obtaining an overall success probability 
of at least 3/4. □ 

It follows from a new result of Beals, Buhrman, Cleve, Moska and de Wolf Q 
that any quantum algorithm capable of deciding with high probability whether 
or not a function F : {0, . . . , — 1} {0, 1} is such that |P^^(1)| < given 
some < i < A^/2, must query F at least Q{\/ Nt ) times. Therefore, our exact 
counting algorithm is optimal. Note also that successive applications of Grover's 
algorithm in which we strike out the solutions as they are found will also provide 
an exact count with high probability, but at a high cost in terms of additional 
quantum memory, that is 0{t). 
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